What is the best way to secure your web resources when you provide API as web service?

Question

Here is the condition: I have a web service API that I am planning to sell as a service. The output of the API contains URI of some resources (say images, videos) that should be accessible to that guy using API.

Exposing URI as is, seems like a bad idea since they can just visit that resource and navigate through.

What I tried?

Selective Passsword protecting the URI resources from apache server configuration. But this would prevent every client from displaying those resources.

What others are doing?

I just looked at how facebook was doing this and it seems they have some sort of encrypted URL for image resources.

Following is an example I got from Barack Obama's FB page:

https://scontent.fblr1-1.fna.fbcdn.net/v/t1.0-9/14925612_10154300250296749_7922327253356496348_n.png?oh=54935f1f517c995295580b55a9a058a0&oe=5925CCFC

How do I achieve this level of security? what are the standard practices and how should I go about implementing them? Any leads would be appreciated!!

Answer 1

Normally an API will be protected by an API Key or an API Secret which is commonly sent in the headers. However, with the wide acceptance of OAuth, developers seems to use this method, which they can set the time for refreshing an OAuth token which is a much better way.

If you still need more protection for your API, (Which I Guess some bank or payment related ones), normally the client send an encrypted string to the server, the server decodes it, then send the response back again in an encrypted string.

So the person with the key can only decrypt the string.

So, in fact, you can mix API secret method with API string encryption for a stronger method.

Answer 2

What you describe is a common use case for resources that are stored in a database or that are dynamically generated. In that case, there is no permanent URL for the resource, but only dynamically generated ones.

In that case, when you get a valid request, the application reads the file and directly writes the content of the file in the response that is sent back to the client. For example In JavaEE, a servlet will process the request, ensure that it is valid, read the file and directly copy the content to the Response output stream.

If you need more details on how to do that, you could try to ask on SO site - do not forget to show that you have done some research and my advice is to first write some code...

Answer 3

I am not getting the idea about navigate through do you mean directory listing or accessing other files through that uri location. if that is the case you can turn off directory listings and other file access, easily through apache config or .htaccess file or if you are having thought, that your original uri can give the idea about your project structure you can rewrite your url using mod_rewrite easily in a .htaccess file.

Answer 4

If the files you need to secure are large static files and you want to benefit from web servers that are optimized for serving static files rather than having your application server serves the large static files, you'd want to look into X-SendFile/X-Accel-Redirect feature that many popular webservers supports.

In a brief, these headers allows you to have your web server actually serve the files but have your application authenticates the request to decide whether or not the access is permitted or even to serve different files to different users. Using these headers, you can, for example, redirect the user to a forbidden error page or to the authentication page if the user don't have access to or is not logged in when they try to access the static file's URL. If the user is logged in and is permitted to access the file, then all you need to do is set the header to serve the file that you want the user to get and when the web server processes your application server's response, it will replace the response body with the file pointed by the header.

Answer 5

Clearly problem for me was directory listing. So disabling directory listing solves my issue.

Here's how to do it:

open the following file:

/etc/apache2/apache2.conf

Find the Following lines

<Directory /var/www/>
# You uncomment the line below to enable the directory listing in Apache
#   Options Indexes FollowSymLinks
    AllowOverride None
    Require all granted
</Directory>

Allow file access but password protect directory listing

Password protect your apache server content

One of my other requirements was that I wanted to allow file access when properly URLed (from api output xml). (i.e. above rule for password protection will work only for the directory and files can be accessed)

I achieved that by adding the following rule:

<Files ?*>
    Order allow,deny
    Allow from all
    Satisfy any
</Files>

which effectively says that files can be accessed.

Here is the apache directory listing documentation